I'm looking to setup a reasonably simple road warrior VPN configuration on our Cisco routers. Frustratingly, I've been searching for this but cannot find a simple complete guide.

  • Multiple (not necessarily many) remote users
  • IPSec / ISAKMP configuration
  • IPv4
  • options for either split tunnel or default gateway mode

What configuration do I need to enter to enable this?

I'm looking for a generic answer, though I'm running c2600-ik9o3s3-mz.123-26.bin if you need to know.


You're looking for a remote access VPN. Cisco Docs

Also you should probably look at the Cisco Secure VPN Client Solutions Guide

|improve this answer|||||

Here's what I've come up with, this should be a decent starting point for creating a VPN configuration. I'm not sure that it's minimal per se, but it should get anybody that's looking for this up and running.

The Cisco Secure VPN Client Solutions Guide that Zypher pointed to was very useful for creating this - there are some good examples in there if you can sift through it.

aaa new-model

! Create a vpn-users DB that points to the local auth service
aaa authentication login vpn-users local
aaa authorization network vpn-users local

! any local user will be allowed to use the VPN
username fred secret 5 SECRET

! Create an ISAKMP policy that handles the ISAKMP negotiation process
crypto isakmp policy 1
 encr aes
 authentication pre-share
 group 2
 lifetime 3600
crypto isakmp keepalive 120 15
crypto isakmp xauth timeout 60

! Group policy for ISAKMP
crypto isakmp client configuration group default
 pool vpn-dynamic-pool

! VPN clients will be assigned addresses out of this pool
ip local pool vpn-dynamic-pool

! Create transform sets that specify how the actual IPSEC traffic will be encrypted
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA-LZS esp-aes esp-sha-hmac comp-lzs

! Create IPSEC policies - any negotiated transform scheme must be specified
! in the map below
crypto dynamic-map vpn-dynamic-map 1
 set transform-set ESP-AES-128-SHA-LZS
crypto dynamic-map vpn-dynamic-map 2
 set transform-set ESP-AES-128-SHA

crypto map vpn-dynamic client authentication list vpn-users
crypto map vpn-dynamic client configuration address respond
crypto map vpn-dynamic isakmp authorization list vpn-users
crypto map vpn-dynamic 1 ipsec-isakmp dynamic vpn-dynamic-map

! Apply the IPSEC map to the external interface
interface ExternalInterface/0
 crypto map vpn-dynamic
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.